Apisecure, 14 & 15 March 2023 - Nir Paz, Product Management at Standard.ai API Security.
summary
Practical checklist for securing APIs at small teams: identify concrete failures like open or broken authentication, object-level authorization and function-level authorization flaws, ghost endpoints and mass assignment; enforce deny-by-default RBAC, MFA, non-guessable IDs, per-request authorization checks and schema validation; choose quotas or rate limit vs throttling for spikes and geovelocity checks; enforce transport+rest encryption, server-side validation, token expirations and one-time tokens; run peer reviews, log audits, threat tests (brute force, DDOS simulation), key management and a prioritized risk table tied into the roadmap.
AI-written summary · about
chapters (9)
- 0:00API security challenges
- 7:07Proactive design for API security
- 15:57API security risks and best practices
- 23:47Access control and rate limiting
- 31:58Encryption and data validation
- 37:40Documentation and logging for security
- 43:02Security testing approaches
- 51:21Key takeaways for developers
- 52:46Q&A
related talks
08mAPI Security Risks
45mSecurity Architecture, An Adventure?
29mAPI Security in 2017
24mAPI Security in DevSecOps: Built-In, Not Bolted On
48mAPI Security for Enterprises fireside chat
54mFive-step plan for securing your APIs
17mAPI Security Simplified: Practical Tips & Tools
24mMastering API Security: From Design to Deployment